In short
- CVE-2021-35936 is a MEDIUM (CVSS 5.3) vulnerability affecting apache-airflow, airflow (apache).
- Chance of exploitation in the next 30 days (EPSS): 5.5%, higher than 92.7% of all vulnerabilities.
- Fix: update to 2.1.2 or later.
Description
If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.
NVD description
If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.
More vulnerabilities in apache-airflow
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free